CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.0.
Explanation of Vulnerability in Simple Terms
simpleSAMLphp Authentication 0.7.0 contains a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts into the application. The vulnerability requires user interaction—the victim must visit a crafted link or page. The impact extends beyond the vulnerable component, potentially affecting other parts of the site or user sessions. Affected sites should update to a version newer than 0.7.0.
What an attacker can do
Inject malicious scripts that execute in a user's browser when they visit a crafted link.
Potential impact on your site
Users' sessions, credentials, or personal data could be compromised if they interact with attacker-crafted links.
Conditions required to exploit
No authentication required. Victim must click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
